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REMARKS 

This Application has been carefully reviewed in light of the Final Office Action dated 
July 7, 2008. Applicants amend Claims 1, 10-12, 14, and 22 for purposes of advancing 
prosecution. Applicants previously canceled Claims 2-3, 5-7, and 17-19 without prejudice or 
disclaimer. Applicants respectfully request reconsideration and favorable action in this case. 

Section 103 Rejections 

Claims 1, 4, 10-16, 21 and 22 are rejected under 35 U.S.C. § 103(a) as being 

unpatentable over U.S. Patent No. 6,192,512 issued to Chess ("Chess") in view of U.S. Patent 

No. 5,389,196 issued to Chambers ("Chambers"), Applicants respectfully traverse this 

rejection. Claim 1 recites: 

A method of detecting viral code in subject files, comprising: 
creating an artificial memory region spanning one or more components 

of the operating system, wherein the artificial memory region is associated 

with an export table of a dynamically-linked library; 

emulating execution of at least a portion of computer executable code 

in a subject file; 

monitoring attempts by the emulated computer executable code to 
access the artificial memory region; 

in response to detecting an attempt to access the artificial memory 
region, determining an export table entry in the export table of the 
dynamically-linked library that is associated with the attempt to access the 
artificial memory region; and 

determining based on the export table entry associated with the attempt 
to access the artificial memory region that the emulated computer executable 
code is viral. 

The proposed Chess-Chambers combination fails to disclose, teach, or suggest every 
element of Claim 1 for at least several reasons. First, the proposed Chess-Chambers 
combination fails to disclose "creating an artificial memory region spanning one or more 
components of the operating system, wherein the artificial memory region is associated with 
an export table of a dynamically-linked library." Second, the proposed Chess-Chambers 
combination fails to disclose "in response to detecting an attempt to access the artificial 
memory region, determining an export table entry in the export table of the dynamically- 
linked library that is associated with the attempt to access the artificial memory region." 
Third, the proposed Chess-Chambers combination fails to disclose "determining based on the 
export table entry associated with the attempt to access the artificial memory region that the 
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emulated computer executable code is viral." As a result, the proposed Chess-Chambers 
combination fails to disclose, teach, or suggest every element of Claim 1 , as discussed further 
below. 

i. "creating an artificial memory region spanning one or more components of the 
operating system, wherein the artificial memory region is associated with an export 
table of a dynamically-linked library" 

The proposed Chess-Chambers combination fails to disclose "creating an artificial 
memory region spanning one or more components of the operating system, wherein the 
artificial memory region is associated with an export table of a dynamically-linked library" as 
recited by Claim 1. In addressing the "creating an artificial memory region . . ." element of 
the previously-presented Claim 1 , the Office Action cites to a portion of Chess that discloses 
only that: 

By example, if it is found that the source program unexpectedly attempts to 
access a virtualized mass storage medium, and/or to create one or more copies 
of itself in a region of virtualized memory, or in a virtual file, then the external 
program can be informed of the potentially viral nature of the source program. 

Chess, col. 5, 11. 49-54. 

The cited portion of Chess, however, fails to disclose "creating an artificial memory 
region spanning one or more components of the operating system, wherein the artificial 
memory region is associated with an export table of a dynamically-linked library "" (emphasis 
added). Combining Chess with Chambers fails to remedy this deficiency as Chambers also 
fails to disclose this element. In particular, neither Chess nor Chambers discloses at least "an 
artificial memory region . . . associated with an export table of a dynamically-linked library." 
As a result, the proposed Chess-Chambers combination fails to disclose "creating an artificial 
memory region spanning one or more components of the operating system, wherein the 
artificial memory region is associated with an export table of a dynamically-linked library" as 
recited by amended Claim 1 . 
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ii. "in response to detecting an attempt to access the artificial memory region, 
determining an export table entry in the export table of the dynamically-linked library 
that is associated with the attempt to access the artificial memory region" 

The proposed Chess-Chambers combination also fails to disclose "in response to 
detecting an attempt to access the artificial memory region, determining an export table entry 
in the export table of the dynamically-linked library that is associated with the attempt to 
access the artificial memory region" as recited by amended Claim 1 . The cited portions of 
both Chess and Chambers fail to disclose any manner of "determining an export table entry 
in [an] export table of [a] dynamically-linked library that is associated with [an] attempt to 
access the artificial memory region." As a result, the proposed Chess-Chambers combination 
fails to disclose "in response to detecting an attempt to access the artificial memory region, 
determining an export table entry in the export table of the dynamically-linked library that is 
associated with the attempt to access the artificial memory region" as recited by Claim 1 . 

iii. "determining based on the export table entry associated with the attempt to 
access the artificial memory region that the emulated computer executable code is viral" 

The proposed Chess-Chambers combination also fails to disclose "determining based 

on the export table entry associated with the attempt to access the artificial memory region 

that the emulated computer executable code is viral" as recited by amended Claim 1. In 

addressing the "determining. . ." element of the previously-presented Claim 1, the Office 

Action references the same portion of Chess discussed above. Specifically, the Office Action 

cites to a portion of Chess that states only that: 

By example, if it is found that the source program unexpectedly attempts to 
access a virtualized mass storage medium, and/or to create one or more copies 
of itself in a region of virtualized memory, or in a virtual file, then the external 
program can be informed of the potentially viral nature of the source program. 

Chess, col. 5, 11. 49-54. 

The cited portion, however, fails to disclose determining anything "based on [an] 
export table entry associated with [an] attempt to access the artificial memory region." As a 
result, Chess fails to disclose "determining based on the export table entry associated with 
the attempt to access the artificial memory region that the emulated computer executable 
code is viral" (emphasis added). Combining Chess with Chambers fails to remedy this 
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deficiency as Chambers also fails to disclose this element. As a result, the proposed Chess- 
Chambers combination fails to disclose "determining based on the export table entry 
associated with the attempt to access the artificial memory region that the emulated computer 
executable code is viral" as recited by amended Claim 1. 

As a result, the proposed Chess-Chambers combination fails to disclose every element 
of amended Claim 1. Claim 1 is thus allowable for at least these reasons. Applicants 
respectfully request reconsideration and allowance of Claim 1 and its dependents. 

Although of differing scope from Claim 1, amended Claims 10-12 and 14 include 
elements that, for reasons substantially similar to those discussed with respect to Claim 1, are 
not disclosed by Chambers, Claims 10-12 and 14 are thus allowable for at least these 
reasons. Applicants respectfully request reconsideration and allowance of Claims 10-12 and 
14, and their respective dependents. 
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Conclusions 

Applicants have made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other reasons clearly apparent, Applicants respectfully 
request full allowance of all pending Claims. If the Examiner feels that a telephone 
conference or an interview would advance prosecution of this Application in any manner, the 
undersigned attorney for Applicants stands ready to conduct such a conference at the 
convenience of the Examiner. 

The Commissioner is hereby authorized to charge the $810.00 RCE filing fee and any 
other required fees or to credit any overpayments to Deposit Account No. 02-0384 of Baker 



Botts L.L.P. 



Respectfully submitted, 



BAKER BOTTS L.L.P. 



Attorneys for Applicants 




Todd A. Cason 
Reg. No. 54,020 



2001 Ross Avenue, Suite 600 
Dallas, Texas 75201-2980 
(214) 953-6452 
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